Latest Cybersecurity News and Articles

---

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

One of the most notorious providers of abuse-friendly "bulletproof" web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab, KrebsOnSecurity has learned.

---

Amnesty Finds Cellebrite’s Zero-Day Used to Unlock Serbian Activist’s Android Phone

A 23-year-old Serbian youth activist had their Android phone targeted by a zero-day exploit developed by Cellebrite to unlock the device, according to a new report from Amnesty International. "The Android phone of one student protester was exploited and unlocked by a sophisticated zero-day exploit chain targeting Android USB drivers, developed by Cellebrite," the international non-governmental

---

Gabbard Decries Britain’s Reported Demand for Apple to Provide Backdoor Access to Users’ Cloud Data

The Director of National Intelligence said such a demand would violate Americans’ rights and raise concerns about a foreign government pressuring a U.S.-based technology company. The post Gabbard Decries Britain’s Reported Demand for Apple to Provide Backdoor Access to Users’ Cloud Data appeared first on SecurityWeek.

---

RDP: a Double-Edged Sword for IT Teams – Essential Yet Exploitable

Remote Desktop Protocol (RDP) is an amazing technology developed by Microsoft that lets you access and control another computer over a network. It’s like having your office computer with you wherever you go. For businesses, this means IT staff can manage systems remotely, and employees can work from home or anywhere, making RDP a true game-changer in today’s work environment. But here’s the

---

Michael R. Centrella named Assistant Director of the USSS Office of Field Operations

Michael R. Centrella has been promoted to Assistant Director of the USSS Office of Field Operations. 

---

5,000 Phishing PDFs on 260 Domains Distribute Lumma Stealer via Fake CAPTCHAs

Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflow's content delivery network (CDN) to deliver the Lumma stealer malware. Netskope Threat Labs said it discovered 260 unique domains hosting 5,000 phishing PDF files that redirect victims to malicious websites. "The attacker uses SEO to trick victims into

---

In Other News: Krispy Kreme Breach Cost, Pwn2Own Berlin, Disney Hack Story

Noteworthy stories that might have slipped under the radar: Krispy Kreme data breach costs $11M, Pwn2Own moves to Berlin, the story of the 2024 Disney hack. The post In Other News: Krispy Kreme Breach Cost, Pwn2Own Berlin, Disney Hack Story appeared first on SecurityWeek.

---

Ransomware Group Takes Credit for Lee Enterprises Attack

The Qilin ransomware gang claims to have stolen 350 Gb of files from Lee Enterprises in the attack that caused newspaper disruptions. The post Ransomware Group Takes Credit for Lee Enterprises Attack appeared first on SecurityWeek.

---

Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes

The Vo1d botnet is now powered by 1.6 million Android TV devices, up from 1.3 million half a year ago.  The post Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes appeared first on SecurityWeek.

---

Microsoft Names Suspects in Lawsuit Against AI Hackers

In a lawsuit targeting cybercriminals who abuse AI services, Microsoft has named individuals from Iran, the UK, China and Vietnam. The post Microsoft Names Suspects in Lawsuit Against AI Hackers appeared first on SecurityWeek.

---

Microsoft Exposes LLMjacking Cybercriminals Behind Azure AI Abuse Scheme

Microsoft on Thursday unmasked four of the individuals that it said were behind an Azure Abuse Enterprise scheme that involves leveraging unauthorized access to generative artificial intelligence (GenAI) services in order to produce offensive and harmful content. The campaign, called LLMjacking, has targeted various AI offerings, including Microsoft's Azure OpenAI Service. The tech giant is

---

12,000+ API Keys and Passwords Found in Public Datasets Used for LLM Training

A dataset used to train large language models (LLMs) has been found to contain nearly 12,000 live secrets, which allow for successful authentication. The findings once again highlight how hard-coded credentials pose a severe security risk to users and organizations alike, not to mention compounding the problem when LLMs end up suggesting insecure coding practices to their users. Truffle

---

Sticky Werewolf Uses Undocumented Implant to Deploy Lumma Stealer in Russia and Belarus

The threat actor known as Sticky Werewolf has been linked to targeted attacks primarily in Russia and Belarus with the aim of delivering the Lumma Stealer malware by means of a previously undocumented implant. Cybersecurity company Kaspersky is tracking the activity under the name Angry Likho, which it said bears a "strong resemblance" to Awaken Likho (aka Core Werewolf, GamaCopy, and

---

Ransomware incidents reached record levels in 2024

An analysis of global ransomware activity reveals ransomware incidents reached record levels in 2024. 

---

26 New Threat Groups Spotted in 2024: CrowdStrike

CrowdStrike has published its 2025 Global
Threat Report, which warns of faster breakout time and an increase in Chinese activity.  The post 26 New Threat Groups Spotted in 2024: CrowdStrike appeared first on SecurityWeek.

---

Hacker Behind Over 90 Data Leaks Arrested in Thailand

A Singaporean man accused of being a hacker responsible for over 90 data leaks has been arrested in Thailand.  The post Hacker Behind Over 90 Data Leaks Arrested in Thailand appeared first on SecurityWeek.

---

MITRE Caldera security advisory warns of maximum severity flaw

MITRE Caldera security advisory warns of maximum severity flaw, and experts weigh share their insights.

---

Silver Fox APT Uses Winos 4.0 Malware in Cyber Attacks Against Taiwanese Organizations

A new campaign is targeting companies in Taiwan with malware known as Winos 4.0 as part of phishing emails masquerading as the country's National Taxation Bureau. The campaign, detected last month by Fortinet FortiGuard Labs, marks a departure from previous attack chains that have leveraged malicious game-related applications. "The sender claimed that the malicious file attached was a list of

---

Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware

The threat actor known as Space Pirates has been linked to a malicious campaign targeting Russian information technology (IT) organizations with a previously undocumented malware called LuckyStrike Agent. The activity was detected in November 2024 by Solar, the cybersecurity arm of Russian state-owned telecom company Rostelecom. It's tracking the activity under the name Erudite Mogwai. The

---

The Hidden Cost of Compliance: When Regulations Weaken Security

The current state of regulation and the overwhelming burden it brings to most enterprises is a discussion worth having The post The Hidden Cost of Compliance: When Regulations Weaken Security appeared first on SecurityWeek.